Securing Critical Infrastructure: Anatomy of the Unitronics PLC Water Sector Attacks

For decades, the standard narrative of critical infrastructure security relied on the concept of the air-gap: the comforting assumption that industrial machinery, isolated from the corporate network and the open internet, was inherently safe from remote interference. Today, that assumption is a dangerous relic. The convergence of Operational Technology (OT) and Information Technology (IT), driven by the demand for remote monitoring and operational efficiency, has bridged the physical and digital worlds.

Nowhere is this vulnerability more apparent than in the Water and Wastewater Systems (WWS) sector. In late 2023, a series of cyber attacks targeted programmable logic controllers across multiple U.S. water facilities, prompting an urgent joint advisory from the Cybersecurity and Infrastructure Security Agency (CISA). The threat actor behind these operations, operating under the moniker “CyberAv3ngers,” demonstrated that compromising municipal water supplies no longer requires sophisticated zero-day exploits. Instead, it often relies on a terrifyingly simple oversight: an unmanaged network port and a factory-default password.

Threat Actor Profile: Unmasking CyberAv3ngers

To understand the mechanics of these attacks, we need to examine who is behind them. CyberAv3ngers emerged as a prominent threat actor group with a distinct operational profile and clear geopolitical motivations. Intelligence assessments, including findings corroborated by cybersecurity agencies and Western governments, have attributed CyberAv3ngers to the Islamic Revolutionary Guard Corps (IRGC)—specifically elements linked to its cyber-warfare apparatus.

Unlike financially motivated ransomware syndicates that encrypt data for Bitcoin, CyberAv3ngers operates primarily with ideological and political motivations. Their campaign has heavily targeted Israeli-made technology across various sectors, including water utilities, energy grids, and manufacturing facilities, regardless of where those assets are geographically deployed.

Their modus operandi typically follows a predictable pattern of opportunistic scanning followed by targeted digital vandalism:

• Mass Reconnaissance: Scanning public-facing IP spaces for specific industrial control system (ICS) ports and device fingerprints.
• Credential Exploitation: Leveraging default or weak administrative credentials to bypass authentication mechanisms.
• Ideological Defacement: Uploading custom graphics to Human-Machine Interface (HMI) screens to broadcast political messaging, proving access while causing psychological and operational disruption.

While the public face of these attacks often involves simple screen defacements, the underlying access grants the threat actors complete administrative control over physical industrial processes. This combination of state-sponsored backing and low-barrier exploitation vectors makes groups like CyberAv3ngers a persistent hazard for small-to-mid-sized utilities that lack dedicated security operations centers (SOCs).

Anatomy of the Exploit: Unitronics PLCs and Port 20256

The primary hardware targeted in the CyberAv3ngers campaign consists of programmable logic controllers manufactured by Unitronics—specifically the Unitronics Vision Series PLCs with integrated Human-Machine Interfaces. These devices are immensely popular in small-to-mid-sized water and wastewater utilities because they offer an all-in-one solution for controlling pumps, valves, and chemical feeders while providing a local operator screen.

However, the architecture of these devices, combined with how they are deployed, introduced a fatal exposure window.

+-------------------------------------------------------+
|                   Public Internet                     |
+-------------------------------------------------------+
                           |
                           | TCP Port 20256 (PCOM)
                           v
+-------------------------------------------------------+
|             Unitronics Vision Series PLC              |
|  +-------------------------------------------------+  |
|  |           Default Credentials ('1111')          |  |
|  +-------------------------------------------------+  |
|  |                Full Admin Access                |  |
|  +-------------------------------------------------+  |
+-------------------------------------------------------+

The exploitation vector relies on a combination of network exposure and weak authentication:

The PCOM Protocol and Port 20256

Unitronics devices communicate using proprietary protocols over TCP/IP, most notably the PCOM protocol. By default, the PCOM service listens on TCP port 20256. This port is used by engineering software like VisiLogic to program, monitor, and debug the PLC remotely. When these devices are connected directly to the internet without a firewall or VPN, port 20256 becomes globally accessible to anyone scanning the IPv4 space.

Default Credentials

The critical vulnerability is not a software bug or a buffer overflow; it is a human configuration failure. Unitronics Vision Series PLCs ship with a default administrative password: 1111.

When threat actors discover an internet-facing PLC listening on port 20256, they can connect using standard tooling or automated scripts, supply the default string 1111, and achieve full administrative privileges. Once authenticated, the attacker has the same level of access as the original commissioning engineer. They can read and write memory registers, upload new ladder logic, modify program parameters, and take complete remote control of the attached HMI display.

The Root Cause: Architectural Flaws in IT/OT Convergence

The Unitronics attacks are a symptom of a much broader, systemic issue within critical infrastructure: the clumsy execution of IT/OT convergence.

For decades, water treatment plants operated on proprietary, isolated networks. Operational technology engineers prioritized availability and safety above all else, often treating security as an afterthought because physical access was required to manipulate equipment. However, economic pressures and operational demands changed this calculus. Facility managers wanted the ability to monitor water levels, chemical balances, and pump statuses from their smartphones or remote laptops.

To achieve this remote visibility quickly and cheaply, many integrators bypassed secure architectural patterns:

• Direct Internet Exposure: Instead of routing remote connections through a secure, multi-factor authenticated Virtual Private Network (VPN), PLCs and remote telemetry units (RTUs) were assigned public IP addresses or connected via cellular gateways with public-facing interfaces.
• Flat Network Architectures: Many small utilities lack proper network segmentation, meaning there is no internal firewall between the enterprise IT network, the SCADA server, and the field-level PLCs. A compromise anywhere on the network often grants lateral movement across the entire operational environment.
• Security Through Obscurity: There has long been a misplaced belief that obscure industrial protocols, proprietary hardware, and non-standard operating systems provide natural immunity against cyber attacks. Incidents like the CyberAv3ngers campaign prove that attackers easily reverse-engineer these protocols, turning obscurity into a false sense of security.

Assessing the Impact: From HMI Defacement to Physical Disruption

When news broke of the attacks on water facilities, initial reports frequently highlighted the “nuisance” nature of the incidents. In several documented cases, the primary observable symptom was a modified HMI screen displaying a political message—such as the CyberAv3ngers banner reading, “You have been hacked,- Israel equipment is hacked.”

It is dangerous to dismiss these incidents as mere digital graffiti. While the attackers chose to announce their presence with visual defacements, the underlying technical access required to change an HMI graphic is identical to the access required to manipulate physical processes.

An attacker who has successfully authenticated via port 20256 with administrative privileges can execute commands that directly affect water treatment operations:

“The level of access granted by default credential compromise is absolute. An adversary who can change an HMI screen can also silently alter chlorine dosing setpoints, manipulate high-lift pump cutoffs, and disable critical alarm thresholds.”

Consider the real-world consequences within a water treatment facility:

• Chemical Dosing Manipulation: Altering the ratio of sodium hypochlorite, fluoride, or coagulants can render drinking water unsafe or cause corrosive damage to distribution infrastructure.
• Pump and Valve Control: Forcibly opening or closing valves out of sequence can cause catastrophic water hammer effects, bursting pipes and draining reservoirs.
• Alarm Blinding: Disabling high-water or low-pressure alarms prevents human operators from recognizing that a physical process has deviated into a dangerous state.

While public health disasters were averted in these specific instances—often because alert operators noticed the unauthorized screen changes and physically tripped local emergency stop switches—the margin for error was razor-thin.

Remediation and Defense: Securing Vulnerable Infrastructure

Securing legacy and modern operational technology requires moving away from fragile perimeters toward defense-in-depth engineering. For engineers and system integrators responsible for water and wastewater assets, immediate mitigation requires a structured approach to asset management and network hardening.

Immediate Mitigation Steps

1. Isolate from the Public Internet: Disconnect all Unitronics PLCs and other industrial controllers from direct exposure to the public internet immediately. No industrial controller should ever possess a public-facing IP address.
2. Change Default Credentials: Modify all administrative and operator passwords immediately. Never leave factory defaults—such as 1111 on Unitronics devices—active in a production environment.
3. Block TCP Port 20256: Ensure that firewalls and perimeter access control lists (ACLs) drop all incoming traffic destined for TCP port 20256 unless it originates from an authorized, internal management network.
4. Implement Secure Remote Access: If remote monitoring is required, replace direct connections with enterprise-grade VPNs utilizing multi-factor authentication (MFA) and strict access controls.

Long-Term Hardening Strategies

• Network Segmentation: Implement the Purdue Enterprise Reference Architecture (PERA) or ISA/IEC 62443 zones and conduits model. Isolate the OT network from the corporate IT network using industrial firewalls and DMZs.
• Comprehensive Asset Discovery: Conduct thorough internal and external asset inventories. Many organizations remain vulnerable simply because management is unaware that a legacy PLC or cellular gateway was exposed to the internet by a third-party vendor during maintenance.
• Continuous Monitoring: Deploy passive network monitoring tools capable of inspecting industrial protocols (like Modbus, DNP3, and proprietary vendor protocols) to detect unauthorized configuration changes, anomalous PLC traffic, or unauthorized connection attempts.

+------------------+     +-------------------+     +------------------+
|    Corporate     |     |  Industrial DMZ   |     |  OT / Control    |
|   IT Network     | --> | (Jump Hosts / VPN)| --> |    Network       |
|                  |     |                   |     |  (PLCs / HMIs)   |
+------------------+     +-------------------+     +------------------+

Future Outlook: The Shift Toward Mandatory OT Cybersecurity

The targeting of critical water infrastructure by state-sponsored actors has fundamentally changed the regulatory landscape. For years, cybersecurity guidance in the water sector relied on voluntary frameworks, self-assessments, and non-binding recommendations from agencies like the EPA and CISA. That era is coming to an end.

Regulators are recognizing that voluntary compliance is insufficient when public safety is on the line. We are seeing a decisive shift toward mandatory cybersecurity standards for water and wastewater utilities, backed by strict regulatory enforcement, audits, and potential penalties for non-compliance. Utilities that fail to implement basic hygiene—such as eliminating default passwords and closing unauthorized ports—will face severe legal and financial liabilities.

Simultaneously, pressure is mounting on hardware and software vendors to adopt “Secure by Design” principles:

• Eliminating Default Passwords: Manufacturers are increasingly expected to ship devices that require unique passwords to be generated during initial commissioning, preventing the use of universal factory defaults.
• Secure Defaults: Protocols that permit administrative functions should be disabled or heavily restricted out-of-the-box, requiring explicit administrative action to enable remote engineering features.
• Built-in Cryptography: Modern industrial controllers are slowly integrating cryptographic authentication and encrypted communication channels by default, phasing out plaintext legacy protocols that lack integrity checks.

Looking further ahead, the sheer volume of connected assets and the speed of modern threat actors mean that human-only defense models are no longer viable. The future of OT security will see the integration of automated threat hunting, AI-driven anomaly detection tailored for industrial time-series data, and automated incident response systems capable of isolating compromised controllers before physical damage can occur.

The attack on Unitronics PLCs was a wake-up call. It demonstrated that nation-state adversaries are actively probing the soft underbelly of critical infrastructure. By abandoning outdated assumptions about air-gapping, enforcing rigorous credential management, and embracing modern zero-trust architecture, engineers can ensure that our water systems remain resilient against the threats of tomorrow.